Improper Input Validation

Overview sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option. Recommendation Upgrade to version 2.3.1 or later References - CVE - GitHub Advisory...

@codious/core (>=1.0.6, <=1.2.6), @koj/strapi (>=1.4.1, <=1.4.3) +6 more potentially affected by CVE-2021-26540 via sanitize-html (>=2.1.0, <=2.3.1)

sanitize-html NPM version =2.1.0, =1.0.6, =1.4.1, =3.37.0, =2.1.56, =2.0.58, =0.12.0, =3.2.5, =3.5.2 Source cves: CVE-2021-26540 Source advisory: OSV:GHSA-MJXR-4V3X-Q3M4...

Improper Input Validation in sanitize-html

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

GHSA-MJXR-4V3X-Q3M4 Improper Input Validation in sanitize-html

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

Improper Input Validation in sanitize-html

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

GHSA-RJQQ-98F6-6J3R Improper Input Validation in sanitize-html

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

@codious/core (>=1.0.6, <=1.2.4), @koj/strapi (>=1.4.1, <=1.4.3) +6 more potentially affected by CVE-2021-26539 via sanitize-html (>=2.1.0, <=2.3.0)

sanitize-html NPM version =2.1.0, =1.0.6, =1.4.1, =3.37.0, =2.1.56, =2.0.58, =0.12.0, =3.2.5, =3.5.2 Source cves: CVE-2021-26539 Source advisory: OSV:GHSA-RJQQ-98F6-6J3R...

CVE-2021-1520 Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability

A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local attacker to run arbitrary commands with root privileges on the underlying operating system OS. This vulnerability exists because an interna...

SQL Injection

illuminate/database is vulnerable to sql injection. The vulnerability exists through the lack of sanitization and direct use of user-provided query via the limit and offset functions...

CVE-2021-21388 Command Injection Vulnerability in systeminformation

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version = 5.6.4. If you cannot...

CVE-2021-22540

Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags...

Adtran Personal Phone Manager 10.8.1 - (emailAddress) Stored Cross-Site Scripting Vulnerability

Exploit Title: Adtran Personal Phone Manager 10.8.1 - 'emailAddress' Stored Cross-Site Scripting XSS Exploit Author: 3ndG4me Vendor Homepage: https://adtran.com/web/page/portal/Adtran/wphome Version: v10.8.1 Tested on: NetVanta 7060 and NetVanta 7100 CVE : CVE-2021-25679 CVE-2021-25679 - Adtran...

GHSA-JFF2-QJW8-5476 Command Injection Vulnerability in systeminformation

Impact command injection vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.6.4 Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite, si.services, si.processLoad ... do onl...

CVE-2021-24176

The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard...

ExpressionEngine 6.0.2 PHP Code Injection

---------------------------------------------------------------------------- ExpressionEngine security-sanitizefilename$file; 366. 367. $destdir = $this-languagesdir . $language . '/'; 368. $filename = $file . 'lang.php'; 369. $destloc = $destdir . $filename; 370. 371. $str = 'lang-loadfile$file;...

CVE-2021-26540

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

DEBIAN-CVE-2021-21315

The System Information Library for Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. ...

CVE-2021-21315

The System Information Library for Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. ...

GHSA-2M8V-572M-FF2V Command Injection Vulnerability

Impact command injection vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.3.1 Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite, si.services, si.processLoad ... do onl...

CVE-2020-29022

CVE-2020-29022 affects Secomea GateManager (all versions prior to 9.3). The vulnerability is due to failure to sanitize the host header value on output in the GateManager Web server, which could allow web cache poisoning attacks. Impact is described as enabling manipulation of cached responses to...